@mpgd/game-services 0.31.0 → 0.32.0

package/README.md

@@ -314,9 +314,14 @@ purchases (Google Play's obfuscated account id, StoreKit's app account
 token). The reconciler then leaves a store purchase bound to another account
 alone (reported, never journaled or verified for this player). After a
 restart as another player, Google Play still lists the previous player's
-unacknowledged purchases; sending one with this player's session would be
-rejected for good, and its derived key would then block the other player's
-own recovery. The player's explicit Restore Purchases still takes a durable
+unacknowledged purchases; sending one with this player's session only gets
+the backend's another-account answer (409 `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT`),
+which parks the record without a grant. The reconciler parks it whenever the
+backend is reached anyway (no binding input, an older client's record): the
+record stays `verifying`, is never resent automatically, and leaves its
+derived key to the purchase's own account on the install
+([another account's purchase](../../docs/GAME_SERVICES_BACKEND.md#another-accounts-purchase)).
+The player's explicit Restore Purchases still takes a durable
 bound to another account (restore sharing). StoreKit's provider already
 filters transactions by app account token the same way.
 

package/dist/another-account.d.ts

@@ -0,0 +1,65 @@
+/**
+* Another account's purchase (RFC "Another account's purchase"): a verify
+* whose store binding (Google Play `obfuscatedAccountId` /
+* `obfuscatedProfileId`, StoreKit `appAccountToken`) names another account
+* than the requesting player's. It is not granted, nothing is recorded, and
+* the store transaction stays recoverable by the account it is bound to, so
+* the backend answers it as a retryable error instead of a `rejected`
+* receipt: HTTP 409 `{ error: 'PURCHASE_BOUND_TO_ANOTHER_ACCOUNT', reason }`,
+* or the oRPC error code `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT` (status 409,
+* `data.reason`). A client from before this answer treats it as a transport
+* failure and keeps the record open; the commerce reconciler parks it.
+*
+* No schema, DOM, or transport dependencies: the server, the client, and a
+* game server wrapping the reference verifiers share these helpers.
+*/
+/** The error code of the answer, on HTTP (`error`) and oRPC (`code`) alike. */
+export declare const purchaseBoundToAnotherAccountCode: 'PURCHASE_BOUND_TO_ANOTHER_ACCOUNT';
+/** The HTTP status of the answer: the purchase conflicts with the requesting player's account. */
+export declare const purchaseBoundToAnotherAccountStatus = 409;
+/**
+* The binding mismatch reasons of the reference verifiers. Each one means
+* the purchase carries another account's binding: a purchase without one
+* answers `GOOGLE_PLAY_ACCOUNT_ID_MISSING`, `GOOGLE_PLAY_PROFILE_ID_MISSING`,
+* `GOOGLE_PLAY_ACCOUNT_BINDING_UNEXPECTED`, or `APP_STORE_ACCOUNT_TOKEN_MISSING`
+* instead, which stay `rejected`. A backend from before this answer, or a game
+* server that maps every refusal to `rejected`, still answers these reasons
+* as a `rejected` receipt; the commerce reconciler reads that receipt as this
+* answer too.
+*/
+export declare const storeAccountMismatchReasons: readonly ["GOOGLE_PLAY_ACCOUNT_MISMATCH", "GOOGLE_PLAY_PROFILE_MISMATCH", "APP_STORE_ACCOUNT_TOKEN_MISMATCH"];
+export type StoreAccountMismatchReason = (typeof storeAccountMismatchReasons)[number];
+export declare function isStoreAccountMismatchReason(reason: unknown): reason is StoreAccountMismatchReason;
+/**
+* Thrown by the reference backend's `verifyPurchase` for another account's
+* purchase; the HTTP handler and the oRPC router turn it into the 409
+* answer. A game server that calls `backend.purchases.verifyPurchase` itself
+* answers it the same way (see `docs/GAME_SERVICES_BACKEND.md`). Its
+* `message` starts with the code, so a Workers RPC caller whose runtime
+* keeps only the message still recognizes it.
+*/
+export declare class GameServicesPurchaseBoundToAnotherAccountError extends Error {
+  readonly code: "PURCHASE_BOUND_TO_ANOTHER_ACCOUNT";
+  readonly status = 409;
+  /** The store's binding mismatch, for example `GOOGLE_PLAY_ACCOUNT_MISMATCH`. */
+  readonly reason: string;
+  constructor(reason: string);
+}
+/** The body of the HTTP 409 answer. */
+export interface PurchaseBoundToAnotherAccountBody {
+  readonly error: typeof purchaseBoundToAnotherAccountCode;
+  readonly reason: string;
+}
+export declare function createPurchaseBoundToAnotherAccountBody(reason: string): PurchaseBoundToAnotherAccountBody;
+/**
+* The binding mismatch of an error that carries the answer, or undefined for
+* any other error. It reads every shape a client meets: the thrown
+* `GameServicesPurchaseBoundToAnotherAccountError` (an in-process backend),
+* an oRPC error (`code`, `data.reason`), a `GameServicesBackendError` of the
+* HTTP transport (`status` 409 and `body.error`), and an error rebuilt from
+* its message alone (a Workers RPC caller without enhanced error
+* serialization).
+*/
+export declare function readPurchaseBoundToAnotherAccount(error: unknown): {
+  readonly reason: string;
+} | undefined;

package/dist/another-account.js

@@ -0,0 +1,107 @@
+/**
+ * Another account's purchase (RFC "Another account's purchase"): a verify
+ * whose store binding (Google Play `obfuscatedAccountId` /
+ * `obfuscatedProfileId`, StoreKit `appAccountToken`) names another account
+ * than the requesting player's. It is not granted, nothing is recorded, and
+ * the store transaction stays recoverable by the account it is bound to, so
+ * the backend answers it as a retryable error instead of a `rejected`
+ * receipt: HTTP 409 `{ error: 'PURCHASE_BOUND_TO_ANOTHER_ACCOUNT', reason }`,
+ * or the oRPC error code `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT` (status 409,
+ * `data.reason`). A client from before this answer treats it as a transport
+ * failure and keeps the record open; the commerce reconciler parks it.
+ *
+ * No schema, DOM, or transport dependencies: the server, the client, and a
+ * game server wrapping the reference verifiers share these helpers.
+ */
+/** The error code of the answer, on HTTP (`error`) and oRPC (`code`) alike. */
+export const purchaseBoundToAnotherAccountCode = 'PURCHASE_BOUND_TO_ANOTHER_ACCOUNT';
+/** The HTTP status of the answer: the purchase conflicts with the requesting player's account. */
+export const purchaseBoundToAnotherAccountStatus = 409;
+/**
+ * The binding mismatch reasons of the reference verifiers. Each one means
+ * the purchase carries another account's binding: a purchase without one
+ * answers `GOOGLE_PLAY_ACCOUNT_ID_MISSING`, `GOOGLE_PLAY_PROFILE_ID_MISSING`,
+ * `GOOGLE_PLAY_ACCOUNT_BINDING_UNEXPECTED`, or `APP_STORE_ACCOUNT_TOKEN_MISSING`
+ * instead, which stay `rejected`. A backend from before this answer, or a game
+ * server that maps every refusal to `rejected`, still answers these reasons
+ * as a `rejected` receipt; the commerce reconciler reads that receipt as this
+ * answer too.
+ */
+export const storeAccountMismatchReasons = Object.freeze([
+    'GOOGLE_PLAY_ACCOUNT_MISMATCH',
+    'GOOGLE_PLAY_PROFILE_MISMATCH',
+    'APP_STORE_ACCOUNT_TOKEN_MISMATCH',
+]);
+export function isStoreAccountMismatchReason(reason) {
+    return typeof reason === 'string'
+        && storeAccountMismatchReasons.includes(reason);
+}
+const reasonPattern = /^[A-Za-z0-9_.:-]{1,128}$/u;
+function readReason(value) {
+    return typeof value === 'string' && reasonPattern.test(value) ? value : undefined;
+}
+/**
+ * Thrown by the reference backend's `verifyPurchase` for another account's
+ * purchase; the HTTP handler and the oRPC router turn it into the 409
+ * answer. A game server that calls `backend.purchases.verifyPurchase` itself
+ * answers it the same way (see `docs/GAME_SERVICES_BACKEND.md`). Its
+ * `message` starts with the code, so a Workers RPC caller whose runtime
+ * keeps only the message still recognizes it.
+ */
+export class GameServicesPurchaseBoundToAnotherAccountError extends Error {
+    code = purchaseBoundToAnotherAccountCode;
+    status = purchaseBoundToAnotherAccountStatus;
+    /** The store's binding mismatch, for example `GOOGLE_PLAY_ACCOUNT_MISMATCH`. */
+    reason;
+    constructor(reason) {
+        const checked = readReason(reason) ?? purchaseBoundToAnotherAccountCode;
+        super(`${purchaseBoundToAnotherAccountCode}: ${checked}`);
+        this.name = 'GameServicesPurchaseBoundToAnotherAccountError';
+        this.reason = checked;
+    }
+}
+export function createPurchaseBoundToAnotherAccountBody(reason) {
+    return {
+        error: purchaseBoundToAnotherAccountCode,
+        reason: readReason(reason) ?? purchaseBoundToAnotherAccountCode,
+    };
+}
+/**
+ * The binding mismatch of an error that carries the answer, or undefined for
+ * any other error. It reads every shape a client meets: the thrown
+ * `GameServicesPurchaseBoundToAnotherAccountError` (an in-process backend),
+ * an oRPC error (`code`, `data.reason`), a `GameServicesBackendError` of the
+ * HTTP transport (`status` 409 and `body.error`), and an error rebuilt from
+ * its message alone (a Workers RPC caller without enhanced error
+ * serialization).
+ */
+export function readPurchaseBoundToAnotherAccount(error) {
+    if (typeof error !== 'object' || error === null) {
+        return undefined;
+    }
+    const candidate = error;
+    const fallback = { reason: purchaseBoundToAnotherAccountCode };
+    if (candidate.code === purchaseBoundToAnotherAccountCode) {
+        const data = candidate.data;
+        const dataReason = typeof data === 'object' && data !== null
+            ? readReason(data.reason)
+            : undefined;
+        const reason = readReason(candidate.reason) ?? dataReason;
+        return reason === undefined ? fallback : { reason };
+    }
+    const body = candidate.body;
+    if (candidate.status === purchaseBoundToAnotherAccountStatus
+        && typeof body === 'object'
+        && body !== null
+        && body.error === purchaseBoundToAnotherAccountCode) {
+        const reason = readReason(body.reason);
+        return reason === undefined ? fallback : { reason };
+    }
+    const message = candidate.message;
+    const prefix = `${purchaseBoundToAnotherAccountCode}: `;
+    if (typeof message === 'string' && message.startsWith(prefix)) {
+        const reason = readReason(message.slice(prefix.length));
+        return reason === undefined ? fallback : { reason };
+    }
+    return undefined;
+}

package/dist/app-store-verifier.js

@@ -250,19 +250,38 @@ async function verifyAppStorePurchase(input, options, now, clockSkewMs) {
     // when every other check passes: the backend's restore sharing policy
     // decides (RFC "Restore sharing"). The client's StoreKit-verified JWS is
     // required, so a transaction id alone never shares a purchase.
-    const foreignBinding = rejection === 'APP_STORE_ACCOUNT_TOKEN_MISMATCH'
+    const tokenMismatch = rejection === 'APP_STORE_ACCOUNT_TOKEN_MISMATCH';
+    if (tokenMismatch) {
+        // Every other check still decides: only a purchase that passes them all
+        // is reported as restorable or as another account's.
+        rejection = validateTransaction(input, transaction, options.bundleId, environment, undefined, nowMs, clockSkewMs);
+    }
+    const foreignBinding = tokenMismatch
         && input.request.intent === 'restore'
         && input.product.type === 'non_consumable'
         && offlineTransaction !== undefined;
-    if (foreignBinding) {
-        rejection = validateTransaction(input, transaction, options.bundleId, environment, undefined, nowMs, clockSkewMs);
-    }
     if (rejection !== undefined) {
         return { status: 'rejected', reason: rejection };
     }
+    if (tokenMismatch && !foreignBinding) {
+        // A transaction without an appAccountToken (bought outside the app, or
+        // by a build that set none) is no account's: refused for every player.
+        // One with another token is that account's, which can still recover it
+        // (RFC "Another account's purchase").
+        return transaction.appAccountToken === undefined
+            ? { status: 'rejected', reason: 'APP_STORE_ACCOUNT_TOKEN_MISSING' }
+            : { status: 'rejected', reason: 'APP_STORE_ACCOUNT_TOKEN_MISMATCH', anotherAccount: true };
+    }
     return {
         ...(foreignBinding
-            ? { status: 'restorable', reason: 'APP_STORE_ACCOUNT_TOKEN_MISMATCH' }
+            ? {
+                status: 'restorable',
+                // Bound to no account, or to another one: the backend refuses the
+                // former for good when no share covers it.
+                reason: transaction.appAccountToken === undefined
+                    ? 'APP_STORE_ACCOUNT_TOKEN_MISSING'
+                    : 'APP_STORE_ACCOUNT_TOKEN_MISMATCH',
+            }
             : { status: 'verified' }),
         verificationId: createVerificationId(transaction),
         verifiedAt: new Date(nowMs).toISOString(),

package/dist/client.js

@@ -191,7 +191,8 @@ export function createGameServicesClient(input) {
                         }
                         else if (!serverResulted) {
                             serverResulted = true;
-                            progress.serverResult(event.response.verified);
+                            // Another account's purchase is a server answer with no grant.
+                            progress.serverResult(event.type === 'verify-result' && event.response.verified);
                         }
                     });
                     try {
@@ -235,7 +236,9 @@ export function createGameServicesClient(input) {
                                     alreadyProcessed: result.verification?.alreadyProcessed,
                                     reason: result.status === 'pending'
                                         ? 'purchase_pending'
-                                        : (result.verification?.reason ?? record?.error?.code),
+                                        : (result.verification?.reason
+                                            ?? record?.anotherAccount?.reason
+                                            ?? record?.error?.code),
                                 },
                             });
                         }

package/dist/commerce-reconciler.d.ts

@@ -55,6 +55,23 @@ export interface CommercePurchaseOperationRecord {
   /** A retryable error on `requested` means the provider proved checkout never started. */
   readonly error?: CommerceErrorInfo;
   readonly revokedBy?: string;
+  /**
+  * The backend answered that the store binds this purchase to another
+  * account than this record's player (RFC "Another account's purchase"):
+  * `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT`, or a `rejected` receipt with a
+  * store binding mismatch reason from a backend before that answer. The
+  * record is parked in `verifying`: never sent again automatically, not
+  * listed among the player's recoverable records, summarized as `rejected`
+  * for this player, and its shared key no longer refuses another player
+  * of the install, who journals the purchase under its own player-scoped
+  * key. Only this player's Restore Purchases, when the store reports the
+  * purchase again, sends it once more.
+  */
+  readonly anotherAccount?: {
+    /** The store's binding mismatch, for example `GOOGLE_PLAY_ACCOUNT_MISMATCH`. */
+    readonly reason: string;
+    readonly reportedAt: string;
+  };
 }
 /**
 * The store key of a commerce v2 purchase record: one namespace per ledger
@@ -65,8 +82,14 @@ export interface CommercePurchaseOperationRecord {
 */
 export declare function createCommercePurchaseOperationKey(target: string, idempotencyKey: string, playerId?: string): string;
 export declare function isCommercePurchaseOperationRecord(record: unknown): record is CommercePurchaseOperationRecord;
-/** Summary status of a record: the RFC mapping, with `revoked` kept distinct. */
+/**
+* Summary status of a record: the RFC mapping, with `revoked` kept distinct.
+* A record parked as another account's purchase is `rejected` for its
+* player: nothing was granted to it, and nothing will be.
+*/
 export declare function summarizeCommercePurchaseOperation(record: CommercePurchaseOperationRecord): CommercePurchaseSummaryStatus;
+/** A `verifying` record the backend answered as another account's purchase. */
+export declare function isParkedForAnotherAccount(record: CommercePurchaseOperationRecord): boolean;
 /**
 * Only `granted` and `finishing` records that hold the backend's ledger entry
 * id and a store transaction may be finished. The StoreKit SDK keeps no
@@ -104,6 +127,18 @@ export type CommerceReconcilerEvent = {
   readonly type: 'verify-result';
   readonly record: CommercePurchaseOperationRecord;
   readonly response: VerifyPurchaseResponse;
+} | {
+  /**
+  * The backend answered the record's verify as another account's
+  * purchase (RFC "Another account's purchase"): the record is parked,
+  * nothing was granted, and it is not a failure. `response` is the
+  * receipt of a backend before that answer (`rejected` with a store
+  * binding mismatch reason); absent for the 409 answer.
+  */
+  readonly type: 'another-account';
+  readonly record: CommercePurchaseOperationRecord;
+  readonly reason: string;
+  readonly response?: VerifyPurchaseResponse;
 } | {
   readonly type: 'failure';
   readonly stage: CommerceReconcilerFailureStage;

package/dist/commerce-reconciler.js

@@ -1,4 +1,5 @@
 import { assertCommercePurchaseTransition, assertRequestPurchaseSupported, CommerceError, commerceErrorInfoOf, createDerivedPurchaseIdempotencyKey, isTerminalCommercePurchaseState, summarizeCommercePurchaseState, } from '@mpgd/platform/commerce';
+import { isStoreAccountMismatchReason, readPurchaseBoundToAnotherAccount, } from './another-account.js';
 import { compareCommerceServiceCapabilities, } from './commerce-evidence-registry.js';
 import { chunkLedgerEntryIds } from './commerce-ledger.js';
 /**
@@ -37,13 +38,37 @@ export function isCommercePurchaseOperationRecord(record) {
         && record !== null
         && record.kind === commercePurchaseOperationKind;
 }
-/** Summary status of a record: the RFC mapping, with `revoked` kept distinct. */
+/**
+ * Summary status of a record: the RFC mapping, with `revoked` kept distinct.
+ * A record parked as another account's purchase is `rejected` for its
+ * player: nothing was granted to it, and nothing will be.
+ */
 export function summarizeCommercePurchaseOperation(record) {
     if (isRetryableBeforeLaunch(record)) {
         return 'failed';
     }
+    if (isParkedForAnotherAccount(record)) {
+        return 'rejected';
+    }
     return summarizeCommercePurchaseState(record.state);
 }
+/** A `verifying` record the backend answered as another account's purchase. */
+export function isParkedForAnotherAccount(record) {
+    return record.state === 'verifying' && record.anotherAccount !== undefined;
+}
+/**
+ * Whether another player's record under a shared key leaves the key to this
+ * player: parked as another account's purchase, or (a journal written before
+ * that answer) `rejected` with a store binding mismatch reason. Either way
+ * the purchase was never its player's, and nothing on the backend holds it.
+ */
+function releasesSharedKey(record) {
+    return isParkedForAnotherAccount(record)
+        || (record.state === 'rejected'
+            && record.response !== undefined
+            && !record.response.verified
+            && isStoreAccountMismatchReason(record.response.reason));
+}
 function isRetryableBeforeLaunch(record) {
     return record.state === 'requested' && record.error?.retryable === true
         && record.purchase === undefined && record.request === undefined;
@@ -483,6 +508,27 @@ export function createCommerceReconciler(input) {
         retryAt.delete(record.idempotencyKey);
         return next;
     };
+    /**
+     * Parks a `verifying` record the backend answered as another account's
+     * purchase, or (`marker` undefined) lets this player's Restore Purchases
+     * send it again. The state stays `verifying`: the record is not ended for
+     * the store transaction, which its account can still recover.
+     */
+    const reviseAnotherAccount = async (record, marker, patch = {}) => {
+        const { anotherAccount: _previous, ...rest } = record;
+        const next = {
+            ...rest,
+            ...patch,
+            ...(marker === undefined ? {} : { anotherAccount: marker }),
+            state: record.state,
+            revision: record.revision + 1,
+            updatedAt: now(),
+        };
+        await journal.replace(record.revision, next);
+        remember(next);
+        retryAt.delete(record.idempotencyKey);
+        return next;
+    };
     /**
      * Where this player's record of an idempotency key lives, and what that key
      * holds now. A record is under the shared key, or under this player's
@@ -496,6 +542,11 @@ export function createCommerceReconciler(input) {
      *   the slot holds, and `recordIn` refuses it.
      * - `probeFree`: when the shared key is free, a record under the scoped key
      *   still answers (retention may have dropped the other player's record).
+     *
+     * Another player's record that was answered as another account's purchase
+     * (`releasesSharedKey`) is never this player's to refuse: the scoped key is
+     * the slot for any kind, as with `takeHeld`, so the purchase's own account
+     * recovers it on the same install.
      */
     const resolveSlot = async (idempotencyKey, options = {}) => {
         const sharedKey = createCommercePurchaseOperationKey(target, idempotencyKey);
@@ -503,6 +554,7 @@ export function createCommerceReconciler(input) {
         const heldByAnother = shared !== undefined && heldByAnotherPlayer(shared);
         const probeScoped = heldByAnother
             ? options.takeHeld === true
+                || (isCommercePurchaseOperationRecord(shared) && releasesSharedKey(shared))
             : shared === undefined && options.probeFree === true;
         if (!probeScoped) {
             return { key: sharedKey, found: shared, heldByAnother };
@@ -532,9 +584,15 @@ export function createCommerceReconciler(input) {
      */
     const readRecord = async (idempotencyKey) => recordIn(await resolveSlot(idempotencyKey), idempotencyKey);
     const ownedRecordsOf = (listed) => listed.filter((record) => isCommercePurchaseOperationRecord(record) && ownsRecord(record));
+    /**
+     * The player's open records. One parked as another account's purchase is
+     * kept in memory, so a store report matches it without the journal's
+     * transaction index, but is not the player's to recover.
+     */
     const listRecoverable = async () => ownedRecordsOf(await journal.listRecoverable(playerId))
         .filter((record) => !isTerminalCommercePurchaseState(record.state))
-        .map(remember);
+        .map(remember)
+        .filter((record) => !isParkedForAnotherAccount(record));
     const listGranted = async () => {
         const listed = journal.listGranted === undefined
             ? []
@@ -717,6 +775,76 @@ export function createCommerceReconciler(input) {
             fail('finish', error, record.idempotencyKey);
         }
     };
+    /**
+     * A store report of a record the backend answered as another account's
+     * purchase. Only this player's Restore Purchases asks again (a restore
+     * sharing policy or a binding may have changed since), with the evidence
+     * the store reports now, so a stale saved request (an expired signed
+     * transaction) is not resent, and as a restore, which the player asked
+     * for (restore sharing may cover a durable the game started, too); other
+     * reports leave it parked. It stays parked until the backend answers
+     * something else: a transport failure (an offline Restore) changes
+     * nothing, so the record never becomes an open attempt that serializes the
+     * player's purchases or holds the shared key against the purchase's
+     * account. Another answer unparks it and settles it as a verify does; a
+     * grant is finished by the pass's recoverable records.
+     *
+     * Returns false when the journal dropped the record before Restore could
+     * rewrite it (another context's save applied the journal's retention after
+     * `rereadParked` read it): the record is forgotten and the caller matches
+     * the report as a purchase the journal does not know.
+     */
+    const reportParked = async (record, purchase, restoring) => {
+        if (!restoring || purchase.state !== 'purchased') {
+            return true;
+        }
+        const request = {
+            ...buildRequest({ ...record, purchase }),
+            intent: 'restore',
+        };
+        let refreshed;
+        try {
+            refreshed = await reviseAnotherAccount(record, record.anotherAccount, {
+                purchase,
+                request,
+            });
+        }
+        catch (error) {
+            if (await rereadParked(record) === undefined) {
+                return false;
+            }
+            throw error;
+        }
+        const answer = await sendVerify(refreshed, request);
+        if (answer === undefined) {
+            return true;
+        }
+        if (answer.kind === 'another-account') {
+            await parkForAnotherAccount(refreshed, request, answer);
+            return true;
+        }
+        await settleVerify(await reviseAnotherAccount(refreshed, undefined), request, answer.response);
+        return true;
+    };
+    /**
+     * The journal's current record of a parked record this session holds, or
+     * undefined (and forgotten) when the journal no longer holds it for this
+     * player: dropped, or the key reserved again for another purchase of the
+     * player, which this purchase's report must never be written onto.
+     */
+    const rereadParked = async (record) => {
+        const current = await journal.read(record.key);
+        if (current !== undefined
+            && isCommercePurchaseOperationRecord(current)
+            && ownsRecord(current)
+            && current.purchase !== undefined
+            && record.purchase !== undefined
+            && samePurchase(current.purchase, record.purchase)) {
+            return remember(current);
+        }
+        records.delete(record.idempotencyKey);
+        return undefined;
+    };
     // Reconciler step 2: match a reported purchase to a journal record.
     const ingestPurchase = async (purchase, restoring) => {
         if (purchase.store !== storeId) {
@@ -746,6 +874,19 @@ export function createCommerceReconciler(input) {
                 record = remember(stored);
             }
         }
+        if (record !== undefined && isParkedForAnotherAccount(record) && restoring) {
+            // Restore Purchases writes the record, so it must still be the journal's:
+            // a journal's retention may have dropped a parked record this session
+            // still holds (RFC "Another account's purchase"). Then the report is a
+            // purchase the journal does not know, and is matched as one.
+            record = await rereadParked(record);
+        }
+        if (record !== undefined && isParkedForAnotherAccount(record)) {
+            if (await reportParked(record, purchase, restoring)) {
+                return;
+            }
+            record = undefined;
+        }
         const account = record !== undefined || (restoring && product.kind === 'durable')
             ? 'own'
             : await accountOf(purchase);
@@ -800,6 +941,16 @@ export function createCommerceReconciler(input) {
                 probeFree: durable,
             });
             record = recordIn(slot, idempotencyKey);
+            if (record !== undefined
+                && isParkedForAnotherAccount(record)
+                && record.logicalId === product.logicalId
+                && record.purchase !== undefined
+                && samePurchase(record.purchase, purchase)) {
+                // Found under its derived key only (a journal without the
+                // transaction index): the same rule as a transaction match.
+                await reportParked(record, purchase, restoring);
+                return;
+            }
             if (record !== undefined
                 && (record.logicalId !== product.logicalId
                     || (record.purchase !== undefined && !samePurchase(record.purchase, purchase)))) {
@@ -863,18 +1014,71 @@ export function createCommerceReconciler(input) {
         retryable: false,
         message,
     });
+    /**
+     * The backend's answer: a response, another account's purchase (the
+     * `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT` error, or a `rejected` receipt with a
+     * store binding mismatch reason from a backend before it), or undefined
+     * for a transport failure.
+     */
     const sendVerify = async (record, request) => {
         emit({ type: 'verify-requested', record });
+        let response;
         try {
-            const response = await backend.verifyPurchase(request);
-            emit({ type: 'verify-result', record, response });
-            return response;
+            response = await backend.verifyPurchase(request);
         }
         catch (error) {
+            const anotherAccount = readPurchaseBoundToAnotherAccount(error);
+            if (anotherAccount !== undefined) {
+                // An answer, not a failure: the caller parks the record and reports it.
+                return { kind: 'another-account', reason: anotherAccount.reason };
+            }
             // Transport failure: the state is kept and the next pass resends the saved request.
             fail('verify', error, record.idempotencyKey);
             return undefined;
         }
+        emit({ type: 'verify-result', record, response });
+        if (!response.verified
+            && response.disposition !== 'pending'
+            && isStoreAccountMismatchReason(response.reason)) {
+            return { kind: 'another-account', reason: response.reason, response };
+        }
+        return { kind: 'response', response };
+    };
+    /**
+     * Parks a `verifying` record the backend answered as another account's
+     * purchase and reports it with an `another-account` event (not a failure).
+     */
+    const parkForAnotherAccount = async (record, request, answer) => {
+        const parked = await reviseAnotherAccount(record, { reason: answer.reason, reportedAt: now() }, { request, ...(answer.response === undefined ? {} : { response: answer.response }) });
+        emit({
+            type: 'another-account',
+            record: parked,
+            reason: answer.reason,
+            ...(answer.response === undefined ? {} : { response: answer.response }),
+        });
+    };
+    /**
+     * Journals the backend's answer to a `verifying` record: `pending` or
+     * `rejected`, or `granted` (returned) for a grant that carries its ledger
+     * entry; a malformed grant is reported and the record kept.
+     */
+    const settleVerify = async (record, request, response) => {
+        if (!response.verified) {
+            if (response.disposition === 'pending') {
+                await write(record, 'pending', { request, response });
+                retryLater(record.idempotencyKey);
+            }
+            else {
+                await write(record, 'rejected', { request, response });
+            }
+            return undefined;
+        }
+        const ledgerEntryId = response.ledgerEntryId;
+        if (typeof ledgerEntryId !== 'string' || ledgerEntryId.trim() === '') {
+            fail('verify', new Error(`A verified response for ${record.idempotencyKey} must carry a ledgerEntryId.`), record.idempotencyKey);
+            return undefined;
+        }
+        return write(record, 'granted', { request, response, ledgerEntryId });
     };
     // Reconciler steps 3 and 4: drive one record as far as the backend and the store allow.
     const drive = async (initial, capabilitiesNow, explicit) => {
@@ -936,29 +1140,30 @@ export function createCommerceReconciler(input) {
                         record = await write(record, 'verifying');
                         continue;
                     case 'verifying': {
+                        if (isParkedForAnotherAccount(record)) {
+                            // Another account's purchase: only this player's Restore
+                            // Purchases sends it again (`ingestPurchase`).
+                            return;
+                        }
                         const request = record.request ?? buildRequest(record);
-                        const response = await sendVerify(record, request);
-                        if (response === undefined) {
+                        const answer = await sendVerify(record, request);
+                        if (answer === undefined) {
                             retryLater(record.idempotencyKey);
                             return;
                         }
-                        if (!response.verified) {
-                            if (response.disposition === 'pending') {
-                                await write(record, 'pending', { request, response });
-                                retryLater(record.idempotencyKey);
-                            }
-                            else {
-                                await write(record, 'rejected', { request, response });
-                            }
+                        if (answer.kind === 'another-account') {
+                            // Not this player's, and not ended for the store transaction:
+                            // never sent again on its own, and the shared key is left to
+                            // the purchase's account (RFC "Another account's purchase").
+                            await parkForAnotherAccount(record, request, answer);
                             return;
                         }
-                        const ledgerEntryId = response.ledgerEntryId;
-                        if (typeof ledgerEntryId !== 'string' || ledgerEntryId.trim() === '') {
-                            fail('verify', new Error(`A verified response for ${record.idempotencyKey} must carry a ledgerEntryId.`), record.idempotencyKey);
+                        const granted = await settleVerify(record, request, answer.response);
+                        if (granted === undefined) {
                             return;
                         }
-                        finalization = response.finalization?.status;
-                        record = await write(record, 'granted', { request, response, ledgerEntryId });
+                        finalization = answer.response.finalization?.status;
+                        record = granted;
                         continue;
                     }
                     case 'granted':
@@ -985,7 +1190,8 @@ export function createCommerceReconciler(input) {
                             if (finalization === undefined) {
                                 // A pass that did not grant resends the saved request to read
                                 // finalization; the backend replays the grant, never a second one.
-                                reread = await sendVerify(record, record.request ?? buildRequest(record));
+                                const answer = await sendVerify(record, record.request ?? buildRequest(record));
+                                reread = answer?.kind === 'response' ? answer.response : undefined;
                                 finalization = reread?.verified === true
                                     ? reread.finalization?.status
                                     : undefined;

package/dist/evidence-verification.d.ts

@@ -34,8 +34,9 @@ export type EvidenceVerificationDecision = {
   * check passed. The reference verifiers answer it only for a request
   * with `intent: 'restore'` of a non-consumable; the backend then grants
   * the player its own share under its `restoreSharing` policy, or
-  * answers `rejected` with `reason` (the binding mismatch) when the
-  * policy refuses. Fields are those of `verified`.
+  * answers `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT` with `reason` (the
+  * binding mismatch) when the policy refuses, as for a `rejected`
+  * decision with `anotherAccount`. Fields are those of `verified`.
   */
   readonly status: 'restorable';
   readonly reason: string;
@@ -49,6 +50,17 @@ export type EvidenceVerificationDecision = {
 } | {
   readonly status: 'rejected';
   readonly reason: string;
+  /**
+  * The store binds the purchase to another account than the requesting
+  * player's (`reason` is the binding mismatch, for example
+  * `GOOGLE_PLAY_ACCOUNT_MISMATCH`), and every other check passed: the
+  * purchase is valid, only not this player's (RFC "Another account's
+  * purchase"). The backend grants nothing, records nothing, and answers
+  * the retryable `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT` error instead of a
+  * `rejected` receipt, so the purchase stays recoverable by its account.
+  * A caller that reads only `status` still refuses it.
+  */
+  readonly anotherAccount?: true;
 };
 export interface VerifyPurchaseEvidenceInput {
   readonly request: VerifyPurchaseRequest;

package/dist/google-play-purchase.js

@@ -326,6 +326,8 @@ async function inspectGooglePlayPurchase(input) {
         return rejected('GOOGLE_PLAY_PROFILE_INVALID');
     }
     let foreignBinding;
+    /** The purchase carries no id where the player's binding has one (bought outside the app). */
+    let missingBinding;
     if (input.accountBinding.status === 'bound') {
         // Defensive invariant: every bound context must carry at least one
         // identifier, even though the constructors below already enforce it.
@@ -338,13 +340,25 @@ async function inspectGooglePlayPurchase(input) {
         if (input.accountBinding.accountId !== undefined
             && obfuscatedExternalAccountId !== input.accountBinding.accountId) {
             foreignBinding = 'GOOGLE_PLAY_ACCOUNT_MISMATCH';
+            missingBinding = obfuscatedExternalAccountId === undefined
+                ? 'GOOGLE_PLAY_ACCOUNT_ID_MISSING'
+                : undefined;
         }
         else if (input.accountBinding.profileId !== undefined
             && obfuscatedExternalProfileId !== input.accountBinding.profileId) {
             foreignBinding = 'GOOGLE_PLAY_PROFILE_MISMATCH';
+            missingBinding = obfuscatedExternalProfileId === undefined
+                ? 'GOOGLE_PLAY_PROFILE_ID_MISSING'
+                : undefined;
         }
         if (foreignBinding !== undefined && input.reportForeignBinding !== true) {
-            return rejected(foreignBinding);
+            // A purchase with no binding is no account's: refused for every
+            // player. One bound to another account is that account's, which can
+            // still recover it: it is reported, not refused for good (RFC
+            // "Another account's purchase"). Every check before this one passed.
+            return missingBinding === undefined
+                ? { status: 'rejected', reason: foreignBinding, anotherAccount: true }
+                : rejected(missingBinding);
         }
         if (foreignBinding === undefined
             && input.accountBinding.profileId === undefined
@@ -357,15 +371,19 @@ async function inspectGooglePlayPurchase(input) {
             return rejected('GOOGLE_PLAY_ACCOUNT_BINDING_REQUIRED');
         }
     }
-    // The unbound opt-in is safe only when the provider response is also unbound.
+    // The unbound opt-in is safe only when the provider response is also
+    // unbound. This backend binds no player, so no player of it can claim a
+    // bound purchase: refused for every player, never as another account's.
     if (input.accountBinding.status === 'unbound'
         && (obfuscatedExternalAccountId !== undefined
             || obfuscatedExternalProfileId !== undefined)) {
-        return rejected('GOOGLE_PLAY_ACCOUNT_MISMATCH');
+        return rejected('GOOGLE_PLAY_ACCOUNT_BINDING_UNEXPECTED');
     }
     return {
         status: 'verified',
-        ...(foreignBinding === undefined ? {} : { foreignBinding }),
+        // A restore reports which: another account's binding, or none at all
+        // (the backend refuses the latter for good when no share covers it).
+        ...(foreignBinding === undefined ? {} : { foreignBinding: missingBinding ?? foreignBinding }),
         purchase: {
             purchaseToken: input.purchaseToken,
             purchaseTokenDigest: await digestPurchaseToken(input.packageName, input.purchaseToken),

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export * from './account-deletion.js';
 export * from './admob-ssv.js';
+export * from './another-account.js';
 export * from './ad-reward-verifier-registry.js';
 export * from './app-store-verifier.js';
 export * from './app-store-recovery.js';

package/dist/index.js

@@ -1,5 +1,6 @@
 export * from './account-deletion.js';
 export * from './admob-ssv.js';
+export * from './another-account.js';
 export * from './ad-reward-verifier-registry.js';
 export * from './app-store-verifier.js';
 export * from './app-store-recovery.js';

package/dist/runtime.d.ts

@@ -1,6 +1,7 @@
 import { type AccountDeletionClient } from './account-deletion.js';
 import type { AnalyticsSink } from '@mpgd/analytics';
 import type { PlatformGateway, PlatformTarget } from '@mpgd/platform';
+import { isHostedGameServicesPath } from '@mpgd/platform/routes';
 import { type GameServicesBackendApi, type GameServicesBackendTransport, type GameServicesClient, type GameServicesHeaderResolver } from './client.js';
 import type { GameServicesLedgerTarget } from './types.js';
 import type { ClientRewardEvidenceRegistry } from './client-reward-evidence.js';
@@ -129,6 +130,17 @@ export declare function createGameServicesRuntime(input: CreateGameServicesRunti
 export declare function resolveGameServicesLedgerTarget(target: PlatformTarget | string): GameServicesLedgerTarget | null;
 export declare function resolveGameServicesAuthorityMode(profile: string): GameServicesAuthorityMode;
 export declare function resolveGameServicesTransport(transport: string | undefined): 'http' | 'orpc';
+export { isHostedGameServicesPath };
+/**
+* Resolve a hosted browser's clean /api ingress before constructing absolute-URL
+* clients. No ambient DOM access: composition roots supply the actual page origin
+* and gateway target. Unresolved/invalid inputs remain invalid for the runtime's
+* fail-closed authority check; this helper never supplies a fallback backend.
+*/
+export declare function resolveGameServicesBaseUrl(baseUrl: string | undefined, context: {
+  readonly target: PlatformTarget | string;
+  readonly pageOrigin?: string;
+}): string | undefined;
 /**
 * Whether a game-services URL may carry a session's credentials in a
 * production build: an absolute https URL with no credentials and a public

package/dist/runtime.js

@@ -1,5 +1,6 @@
 import { AccountDeletionError, createAccountDeletionClient, } from './account-deletion.js';
 import { CommerceError } from '@mpgd/platform/commerce';
+import { isHostedGameServicesPath } from '@mpgd/platform/routes';
 import { assertCommerceStaleLaunchedAfterMs, createGameServicesClient, createGameServicesFetchBackendTransport, createGameServicesHttpBackendApi, createGameServicesOrpcBackendApi, createGameServicesOrpcClient, resolveGameServicesRequestHeaders, } from './client.js';
 import { gameServicesPlayerChangedCode, GameServicesRuntimeClosedError, gameServicesRuntimeDisposedCode, gameServicesSessionRequiredCode, } from './request-headers.js';
 import { createRecoverableMonetizationClient, } from './monetization-recovery.js';
@@ -492,6 +493,28 @@ function normalizeBaseUrl(baseUrl) {
     const normalized = baseUrl?.trim();
     return normalized === undefined || normalized.length === 0 ? undefined : normalized;
 }
+export { isHostedGameServicesPath };
+/**
+ * Resolve a hosted browser's clean /api ingress before constructing absolute-URL
+ * clients. No ambient DOM access: composition roots supply the actual page origin
+ * and gateway target. Unresolved/invalid inputs remain invalid for the runtime's
+ * fail-closed authority check; this helper never supplies a fallback backend.
+ */
+export function resolveGameServicesBaseUrl(baseUrl, context) {
+    const value = normalizeBaseUrl(baseUrl);
+    if (value === undefined || (context.target !== 'browser' && context.target !== 'microsoft-store')
+        || value !== baseUrl || !isHostedGameServicesPath(value)) {
+        return value;
+    }
+    const origin = context.pageOrigin === undefined
+        ? undefined
+        : parseAbsoluteUrl(context.pageOrigin);
+    if (origin === undefined || origin.origin !== context.pageOrigin
+        || (origin.protocol !== 'https:' && origin.protocol !== 'http:')) {
+        return value;
+    }
+    return new URL(value, origin).href;
+}
 /**
  * Whether a game-services URL may carry a session's credentials in a
  * production build: an absolute https URL with no credentials and a public

package/dist/server.d.ts

@@ -3,6 +3,7 @@ import { type AdPlacements, type ProductCatalog } from '@mpgd/catalog';
 import { type GameServicesBackendApi, type GameServicesBackendTransport, type GameServicesBackendTransportRequest, type GameServicesBackendTransportResponse } from './client.js';
 import { type CommerceEvidenceRegistry } from './commerce-evidence-registry.js';
 import { type PlayerDataErasureInput, type PlayerDataErasureResult } from './account-deletion.js';
+import { purchaseBoundToAnotherAccountCode } from './another-account.js';
 import { type GameServicesHealthResponse } from './contract.js';
 import { type GameServicesEvidenceVerifier, type GameServicesPurchaseGrantFinalizer } from './evidence-verification.js';
 import { type ClaimAdRewardRequest, type ClaimAdRewardResponse, type EntitlementLedgerGrant, type EntitlementLedgerNote, type EntitlementLedgerResult, type EntitlementLedgerRevocation, type EntitlementRevocationTransaction, type GameServicesAdRewardTarget, type GameServicesStoreTarget, type LeaderboardScoreTransaction, type ProductGrantTransaction, type PurchaseLedgerStatusRequest, type RecordLeaderboardScoreRequest, type RecordLeaderboardScoreResponse, type VerifyPurchaseRequest, type VerifyPurchaseResponse } from './types.js';
@@ -58,11 +59,15 @@ export interface GameServicesBackendApiHandler {
   handle(request: GameServicesBackendTransportRequest): Promise<GameServicesBackendTransportResponse>;
 }
 /** Stable error codes emitted by the backend API handler and the HTTP fetch handler. */
-export type GameServicesBackendErrorCode = 'INVALID_REQUEST' | 'INVALID_JSON' | 'PAYLOAD_TOO_LARGE' | 'METHOD_NOT_ALLOWED' | 'UNKNOWN_ENDPOINT' | 'INTERNAL_ERROR';
+export type GameServicesBackendErrorCode = 'INVALID_REQUEST' | 'INVALID_JSON' | 'PAYLOAD_TOO_LARGE' | 'METHOD_NOT_ALLOWED' | 'UNKNOWN_ENDPOINT' | 'INTERNAL_ERROR'
+/** 409: the store binds the purchase to another account (RFC "Another account's purchase"). */
+| typeof purchaseBoundToAnotherAccountCode;
 export interface GameServicesBackendErrorResponse {
   readonly error: GameServicesBackendErrorCode;
   /** Present only for `INVALID_REQUEST`; never carries internal failure details. */
   readonly message?: string;
+  /** Present only for `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT`: the store's binding mismatch. */
+  readonly reason?: string;
 }
 export interface GameServicesStore {
   recordEntitlementGrant(input: EntitlementLedgerGrant): Promise<EntitlementLedgerResult>;
@@ -239,6 +244,16 @@ export declare function createGameServicesRouter(backend: GameServicesBackendApi
     recordScore: import("@orpc/server").ImplementedProcedure<GameServicesOrpcContext & object, object, import("@orpc/contract").Schema<RecordLeaderboardScoreRequest, RecordLeaderboardScoreRequest>, import("@orpc/contract").Schema<RecordLeaderboardScoreResponse, RecordLeaderboardScoreResponse>, Record<never, never>>;
   };
 };
+/**
+* The RPC handler's error status map: oRPC's common codes and
+* `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT` at 409. oRPC 2.0.0-beta.46 derives the
+* HTTP status of an error from its code through this map (an `ORPCError`
+* carries no status of its own), so a host that mounts
+* `createGameServicesRouter` in its own `RPCHandler` passes it as
+* `errorStatusMap` to answer 409 too; without it the code still reaches the
+* client, with status 500.
+*/
+export declare const gameServicesRpcErrorStatusMap: Readonly<Record<string, number>>;
 export declare function createGameServicesRpcFetchHandler(router: ReturnType<typeof createGameServicesRouter>, options?: CreateGameServicesRpcFetchHandlerOptions): (request: Request) => Promise<Response>;
 export declare function createGameServicesHttpFetchHandler(handler: GameServicesBackendApiHandler, options?: CreateGameServicesFetchHandlerOptions): (request: Request) => Promise<Response>;
 export * from './notification-delivery.js';

package/dist/server.js

@@ -1,3 +1,4 @@
+import { COMMON_ERROR_STATUS_MAP } from '@orpc/client';
 import { implement, ORPCError } from '@orpc/server';
 import { RPCHandler } from '@orpc/server/fetch';
 import { RequestLimitHandlerPlugin } from '@orpc/server/plugins';
@@ -7,6 +8,7 @@ import { gameServicesBackendEndpoints, } from './client.js';
 import { resolveCommerceStoreId, } from './commerce-evidence-registry.js';
 import { createPurchaseHolderEvidenceVerificationId, findEntitlementRevocationsChunked, findPurchaseWideRevocation, holderRevocationEvidenceId, isEntitlementGrantReversed, isRestoredAcrossPlayers, listPurchaseHolders, readPurchaseLedgerStatuses, readPurchaseVerificationId, RevocationKeyConflictError, revokeEntitlementGrant, } from './commerce-ledger.js';
 import { assertPlayerDataErasureInput, createRetainedLedgerEntryId, detachRetainedLedgerPayload, isRetainedPlayerId, } from './account-deletion.js';
+import { createPurchaseBoundToAnotherAccountBody, GameServicesPurchaseBoundToAnotherAccountError, isStoreAccountMismatchReason, purchaseBoundToAnotherAccountCode, purchaseBoundToAnotherAccountStatus, } from './another-account.js';
 import { gameServicesContract } from './contract.js';
 import { addLegacyOrpcErrorFlag } from './orpc-error-compat.js';
 import { createRejectingGameServicesEvidenceVerifier, } from './evidence-verification.js';
@@ -407,6 +409,23 @@ export function createGameServicesBackend(input) {
                         : { purchaseGrantFinalizer }),
                     ...(registry === undefined ? {} : { registry }),
                 }, async (verification) => {
+                    if (verification instanceof GameServicesPurchaseBoundToAnotherAccountError) {
+                        // Refused for this player, not decided for its account: tracked
+                        // as a refusal with the mark, never as a pending purchase.
+                        await analytics.track({
+                            name: 'purchase_rejected',
+                            properties: {
+                                target: request.target,
+                                store: resolveCommerceStoreId(request),
+                                playerId: request.playerId,
+                                productId: request.productId,
+                                alreadyProcessed: false,
+                                reason: verification.code,
+                                boundToAnotherAccount: verification.reason,
+                            },
+                        });
+                        return;
+                    }
                     await analytics.track({
                         name: verification.verified ? 'purchase_granted'
                             : verification.disposition === 'pending' ? 'purchase_pending' : 'purchase_rejected',
@@ -521,6 +540,12 @@ export function createGameServicesBackendApiHandler(input) {
                 if (error instanceof GameServicesRequestValidationError) {
                     return errorResponse(400, 'INVALID_REQUEST', error.message);
                 }
+                if (error instanceof GameServicesPurchaseBoundToAnotherAccountError) {
+                    return {
+                        status: purchaseBoundToAnotherAccountStatus,
+                        body: createPurchaseBoundToAnotherAccountBody(error.reason),
+                    };
+                }
                 reportInternalError(input.onInternalError, error);
                 return errorResponse(500, 'INTERNAL_ERROR');
             }
@@ -573,6 +598,15 @@ export function createGameServicesRouter(backend, options = {}) {
             if (error instanceof GameServicesRequestValidationError) {
                 throw new ORPCError('BAD_REQUEST', { message: error.message });
             }
+            if (error instanceof GameServicesPurchaseBoundToAnotherAccountError) {
+                // A retryable answer, not an internal error: the code and reason reach the client.
+                // oRPC beta.46 errors carry no status: `gameServicesRpcErrorStatusMap`
+                // (used by `createGameServicesRpcFetchHandler`) maps the code to 409.
+                throw new ORPCError(purchaseBoundToAnotherAccountCode, {
+                    message: error.message,
+                    data: { reason: error.reason },
+                });
+            }
             reportInternalError(options.onInternalError, error);
             throw error;
         }
@@ -612,8 +646,22 @@ export function createGameServicesRouter(backend, options = {}) {
         }),
     });
 }
+/**
+ * The RPC handler's error status map: oRPC's common codes and
+ * `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT` at 409. oRPC 2.0.0-beta.46 derives the
+ * HTTP status of an error from its code through this map (an `ORPCError`
+ * carries no status of its own), so a host that mounts
+ * `createGameServicesRouter` in its own `RPCHandler` passes it as
+ * `errorStatusMap` to answer 409 too; without it the code still reaches the
+ * client, with status 500.
+ */
+export const gameServicesRpcErrorStatusMap = Object.freeze({
+    ...COMMON_ERROR_STATUS_MAP,
+    [purchaseBoundToAnotherAccountCode]: purchaseBoundToAnotherAccountStatus,
+});
 export function createGameServicesRpcFetchHandler(router, options = {}) {
     const rpcHandler = new RPCHandler(router, {
+        errorStatusMap: { ...gameServicesRpcErrorStatusMap },
         plugins: [
             new RequestLimitHandlerPlugin({
                 maxBodySize: resolveMaxBodyBytes(options.maxBodyBytes),
@@ -787,7 +835,21 @@ async function verifyPurchaseWithStore(input, context, onDecision) {
             : { deploymentTarget: request.deploymentTarget }),
     };
     return withEntitlementRetryLock(retryIdentity, async () => {
-        const verification = await verifyPurchaseForRetry(request, retryIdentity, context);
+        let verification;
+        try {
+            verification = await verifyPurchaseForRetry(request, retryIdentity, context);
+        }
+        catch (error) {
+            if (error instanceof GameServicesPurchaseBoundToAnotherAccountError) {
+                try {
+                    await onDecision(error);
+                }
+                catch {
+                    // Analytics is best-effort: a failed report never replaces the answer.
+                }
+            }
+            throw error;
+        }
         await onDecision(verification);
         return verification;
     });
@@ -862,18 +924,27 @@ async function verifyPurchaseForRetry(request, retryIdentity, context) {
         ? routedEntry.entry.store
         : resolveCommerceStoreId(request);
     if (verification.status === 'restorable') {
-        // A verified restore of a purchase the store binds to another player.
+        // A verified restore of a purchase the store binds to another player, or to none.
         return shareRestoredPurchase(request, {
             product,
             platformProductId,
             verification,
             verifiedStore,
-            refusal: assertVerifyPurchaseResponse({
-                verified: false,
-                alreadyProcessed: false,
-                disposition: 'rejected',
-                reason: verification.reason,
-            }),
+            refusal: () => {
+                if (isStoreAccountMismatchReason(verification.reason)) {
+                    // No share for this player: the purchase stays its account's,
+                    // which can still restore it (RFC "Another account's purchase").
+                    throw new GameServicesPurchaseBoundToAnotherAccountError(verification.reason);
+                }
+                // Bound to no account (`*_MISSING`) or a custom verifier's reason:
+                // no account can claim it, so the refusal is final.
+                return assertVerifyPurchaseResponse({
+                    verified: false,
+                    alreadyProcessed: false,
+                    disposition: 'rejected',
+                    reason: verification.reason,
+                });
+            },
         }, context);
     }
     if (verification.status !== 'verified') {
@@ -883,6 +954,12 @@ async function verifyPurchaseForRetry(request, retryIdentity, context) {
         if (racedExisting !== undefined) {
             return completeExistingRetry(racedExisting);
         }
+        if (verification.status === 'rejected' && verification.anotherAccount === true) {
+            // Another account's valid purchase: nothing is granted or recorded, and
+            // the answer is a retryable error, never a `rejected` receipt that would
+            // end the client's record and block its account's recovery.
+            throw new GameServicesPurchaseBoundToAnotherAccountError(verification.reason);
+        }
         return assertVerifyPurchaseResponse({
             verified: false,
             alreadyProcessed: false,
@@ -1111,6 +1188,15 @@ function createPurchaseGrantPayload(request, input) {
         evidenceVerifiedAt: input.verification.verifiedAt,
     };
 }
+/**
+ * Whether the `share` policy applies: a non-consumable, asked as a restore
+ * unless the store binds it to this player.
+ */
+function sharesRestoredPurchase(request, product, context, bindingMatches = false) {
+    return context.restoreSharing.mode === 'share'
+        && (request.intent === 'restore' || bindingMatches)
+        && product.type === 'non_consumable';
+}
 /**
  * A verified restore of a non-consumable the store binds to another player
  * (RFC "Restore sharing"). Under the `share` policy, for a request with
@@ -1125,10 +1211,8 @@ function createPurchaseGrantPayload(request, input) {
 async function shareRestoredPurchase(request, input, context) {
     const { store, restoreSharing: policy } = context;
     const { product, verification } = input;
-    if (policy.mode !== 'share'
-        || (request.intent !== 'restore' && input.bindingMatches !== true)
-        || product.type !== 'non_consumable') {
-        return input.refusal;
+    if (!sharesRestoredPurchase(request, product, context, input.bindingMatches === true)) {
+        return typeof input.refusal === 'function' ? input.refusal() : input.refusal;
     }
     const purchaseVerificationId = verification.verificationId;
     const notGranted = (disposition, reason) => ({
@@ -1740,6 +1824,9 @@ function assertEvidenceVerificationDecision(decision) {
     }
     if (decision.status === 'rejected') {
         assertNonEmptyDecisionString(decision.reason, 'reason');
+        if (decision.anotherAccount !== undefined && decision.anotherAccount !== true) {
+            throw new Error('Evidence verification anotherAccount must be true when present.');
+        }
         return decision;
     }
     throw new Error('Unknown evidence verification status.');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/game-services",
-  "version": "0.31.0",
+  "version": "0.32.0",
   "description": "Client, contract, server, store, and test helpers for authoritative mpgd game services.",
   "license": "MIT",
   "repository": {
@@ -231,9 +231,9 @@
     "@orpc/client": "2.0.0-beta.46",
     "@orpc/contract": "2.0.0-beta.46",
     "@orpc/server": "2.0.0-beta.46",
-    "@mpgd/analytics": "0.5.6",
-    "@mpgd/catalog": "0.14.0",
-    "@mpgd/platform": "0.33.0"
+    "@mpgd/analytics": "0.5.7",
+    "@mpgd/platform": "0.34.0",
+    "@mpgd/catalog": "0.14.1"
   },
   "peerDependencies": {
     "@apple/app-store-server-library": "^3.1.0"